Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
453 rules
Linux auditctl -D used to delete all audit rules
Flags auditctl -D executions that delete all audit rules and watchers on Linux.
Mohamed LAKRI, Huntrule TeamLinuxprocess_creationHigh476Free2025-10-17Linux sudo --chroot Command Execution
Identifies Linux executions of sudo with chroot-related options ("--chroot" or "-R") via process creation command-line telemetry.
Swachchhanda Shrawn Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationLow255Free2025-10-02Linux Process Execution of TruffleHog with Secret-Scanning Platforms
Flags Linux execution of TruffleHog when command lines reference common source platforms and cloud targets.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium411Free2025-09-24Linux: Suspicious curl/wget Download to /tmp or /dev/shm Followed by sh -c Execution
Flags curl/wget retrieving content into /tmp or /dev/shm followed by immediate sh -c execution on Linux.
Aayush Gupta, Huntrule TeamLinuxprocess_creationHigh192Free2025-06-17Linux mknod Syscall Used to Create Special Files
Flags mknod syscall activity in Linux auditd, indicating special file/device node creation.
Milad Cheraghi, Huntrule TeamLinuxauditdLow101Free2025-05-31Linux sysinfo Syscall for System Information Discovery
Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.
Milad Cheraghi, Huntrule TeamLinuxauditdLow213Free2025-05-30Linux auditd: Clear kernel ring buffer via syslog syscall (action 5/4/6)
Flags auditd syslog syscall actions that clear or suppress kernel ring buffer (dmesg) logs.
Milad Cheraghi, Huntrule TeamLinuxauditdMedium153Free2025-05-27Linux: Disable ASLR via personality syscall or sysctl/randomize_va_space changes
Flags Linux events where ASLR is disabled using the personality syscall or sysctl setting kernel.randomize_va_space=0.
Milad Cheraghi, Huntrule TeamLinuxauditdHigh152Free2025-05-26Linux auditd: Detect writes to /proc/sysrq-trigger or sysrq-related config for Magic SysRq abuse
Alerts on auditd PATH events referencing /sysrq or /sysrq-trigger, indicating possible Linux Magic SysRq abuse.
Milad Cheraghi, Huntrule TeamLinuxauditdMedium446Free2025-05-23Linux: Shell spawned by rsync without -e flag in command line
Flags rsync/rsyncd spawning a shell when rsync lacks the expected " -e " command-line flag.
Florian Roth, Huntrule TeamLinuxprocess_creationHigh414Free2025-01-18Linux: rsync Used to Spawn a Shell via Command-Line -e
Alerts when rsync is run with -e to execute a shell interpreter on Linux.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth, Huntrule TeamLinuxprocess_creationHigh181Free2024-09-02Linux Inline Python (-c) Calling os.system to Spawn Shell
Flags Linux processes launching inline Python (-c) that invokes os.system() to execute a shell.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh482Free2024-09-02Linux process execution of shell via nice utility
Flags Linux process creation where nice is used to spawn a shell (bash/dash/fish/sh/zsh).
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh353Free2024-09-02Linux: Git Process Used to Launch a Shell via Bash/Dash/Sh Input Redirection
Flags Linux command lines where git usage (with -p and help) triggers bash/dash/sh execution via stdin redirection.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh308Free2024-09-02Linux Process Creation: GCC/C89/C99 Wrapper Executing Shell via -wrapper
Flags gcc/c89/c99 executions that use -wrapper to invoke common shells with -s.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh222Free2024-09-02